Act immediately: Report the theft at IdentityTheft.gov to create your personalized recovery plan and official Identity Theft Report within 24-48 hours.
Protect your credit: Place a fraud alert (one call, lasts one year) or security freeze (contact each bureau, blocks new credit). Both are free and powerful tools to stop thieves.
Secure your accounts: Contact your bank and credit card companies immediately to close compromised accounts, dispute unauthorized charges, and change all passwords and PINs.
Clean up fraudulent accounts: Use your FTC Identity Theft Report to dispute fake accounts with creditors and credit bureaus, removing fraudulent debts from your record.
Monitor and prevent: Check your free credit reports regularly, consider an IRS Identity Protection PIN for tax filing, and stay vigilant for at least one year after the theft.
Get specialized help when needed: Tax identity theft, unemployment fraud, medical ID theft, and child identity theft each require specific reporting steps to the appropriate agencies.
What Identity Theft Really Means
Identity theft occurs when someone uses your personal information (your Social Security number, bank account details, credit card numbers, or other identifying data) without permission to commit fraud or gain financial benefits. This isn't just about stolen credit cards. Thieves can file fake tax returns in your name, drain your bank accounts, open new credit lines you never authorized, or even get medical treatment using your insurance.
The warning signs often appear suddenly: unfamiliar charges on your statements, credit cards you didn't apply for arriving in the mail, incorrect accounts on your credit report, or collection notices for purchases you never made. You might receive a notice that your information was part of a data breach, or the IRS might reject your tax return because someone already filed using your Social Security number.
If any of these happen to you, do not panic. Act fast. The federal government provides free tools and a clear recovery roadmap. Every day matters when limiting the damage, but thousands of people successfully resolve identity theft every year by following the official steps below.
First 24-48 Hours: Protect Your Accounts and Start Recovery
First 24-48 Hours: Do These Four Things
1. Report the Theft at IdentityTheft.gov
IdentityTheft.gov is the federal government's one-stop recovery portal. It walks you through guided questions about what happened and generates a personalized recovery plan tailored to your situation. Most importantly, it creates an official FTC Identity Theft Report: a legal document you'll need when dealing with creditors, debt collectors, and credit bureaus.
Save and print multiple copies of your recovery plan and Identity Theft Report. You'll reference them repeatedly over the coming weeks. If you prefer phone assistance, call the Identity Theft Helpline at 1-877-438-4338.
2. Place a Fraud Alert or Security Freeze on Your Credit
| Feature | Fraud Alert | Security Freeze |
|---|---|---|
| What it does | Requires extra identity verification before opening new credit. | Blocks access to your credit file to stop new account fraud (the most effective protection against new account fraud). |
| Who to contact | You only need to contact one credit bureau, and they'll notify the other two. | You must contact each of the three credit bureaus individually. |
| Duration | Initial 1 year; extended 7 years with an Identity Theft Report. | Stays until you lift it; you can temporarily lift for applications. |
| Cost | Free | Free to place and free to lift temporarily. |
| Impact on credit score | No impact | No impact (a freeze doesn't affect your credit score). |
| Best for | Active credit users who want fewer steps during applications. | Maximum protection, especially if you are not opening new accounts soon. |
| Bureau | Website | Phone |
|---|---|---|
| Equifax | equifax.com/personal/credit-report-services | 1-800-685-1111 |
| Experian | experian.com/help | 1-888-397-3742 |
| TransUnion | transunion.com/credit-help | 1-888-909-8872 |
3. Contact Your Bank and Credit Card Companies
Call the fraud department at every financial institution where you have accounts. Report any unauthorized transactions you've spotted, even small ones. Thieves often test accounts with tiny charges first. Ask the company to close or freeze compromised accounts and issue new cards with different account numbers.
For credit card fraud, you have strong legal protections. Under federal law, you can dispute unauthorized charges and your card issuer must investigate. Your liability for unauthorized charges is typically limited to $50. Most issuers waive even that amount. See FTC guidance on liability limits.
For bank accounts and debit cards, report errors immediately. Under Regulation E, your bank must investigate unauthorized transactions. Notify your bank within two business days of discovering fraud to limit your liability to $50. See 12 CFR §1005.6 for liability tiers.
Change all online banking passwords, PINs, and security questions. Use strong, unique passwords for each account.
4. Get Your Credit Reports and Review Them
You're entitled to free weekly credit reports from all three bureaus at annualcreditreport.com or by calling 1-877-322-8228. Review each report carefully for accounts you don't recognize, inquiries you didn't authorize, or addresses where you've never lived.
Make a list of every fraudulent item you find. You'll use this list in the next phase of your recovery.
Complete Recovery Plan: Step-by-Step
With the urgent steps done, it’s time to clean your records and close every fraudulent door. Work through these in order. Each step reinforces the last.
Step 1: Create Your Official Identity Theft Report
If you haven't already, go to IdentityTheft.gov and complete the full report. The system will ask detailed questions about what happened and generate pre-filled letters and forms you can send to creditors and credit bureaus. This report carries legal weight. It is your proof that you're a victim of identity theft.
The FTC Identity Theft Report can be used in place of a police report when clearing fraudulent information from your accounts. Keep both digital and printed copies in a safe place.
Step 2: Decide Between Fraud Alert and Credit Freeze (or Use Both)
If you only placed a fraud alert in the first 48 hours, consider whether you also want a security freeze for maximum protection. Here's how they compare:
When a fraud alert makes sense: You're still actively using credit (applying for loans, new credit cards, etc.) and want to minimize hassle while adding a layer of protection. Creditors will see the alert and should call to verify your identity before opening accounts. It's easier to manage because you only contact one bureau.
When a security freeze makes sense: You want the strongest possible protection and don't mind the extra step of temporarily lifting the freeze when you need to apply for credit. This is ideal if you're not planning to open new accounts soon or if the identity theft was severe. Remember, a freeze doesn't affect your credit score or existing accounts.
Many identity theft victims use both: they place a fraud alert for the convenience and add a security freeze for the extra protection. Both are free, so there's no financial reason not to use both if you want maximum security.
Step 3: Close or Freeze Affected Accounts and Dispute Fraudulent Charges
For every account that was compromised or opened fraudulently, take these actions:
Existing accounts with unauthorized charges: Call the fraud department and dispute the charges in writing. For credit cards, send a dispute letter within 60 days of the statement date showing the fraudulent charge. For bank accounts, report errors quickly under Regulation E - the sooner you report, the better your legal protections.
Ask the company to close the account and issue a new account number. Get written confirmation that the fraudulent charges were removed and that you're not responsible for them. Save all correspondence.
New accounts opened in your name: Contact the company's fraud department immediately. Explain that you're a victim of identity theft and didn't open the account. Request that they close the account and send you a letter confirming it was fraudulent. You'll need this documentation when you dispute the account with credit bureaus.
Step 4: Dispute Fraudulent Accounts and Clean Up Your Credit Reports
Now it's time to remove fraudulent information from your credit reports. You have legal rights here. Use them.
Send dispute letters to both the credit bureaus (Equifax, Experian, TransUnion) and the companies that furnished the fraudulent information. Use your FTC Identity Theft Report as proof. The FTC website provides sample letters you can customize.
Under the Fair Credit Reporting Act, you have the right to block fraudulent information on your credit reports. To do this, send the credit bureaus:
Your Identity Theft Report from IdentityTheft.gov
Proof of your identity (copy of driver's license or government ID)
A letter identifying each fraudulent item and explaining it resulted from identity theft
The credit bureaus must investigate your dispute. They typically have 30 days to complete their investigation, though they may request additional documentation within 15 days if your initial report lacks detail. If they verify the information is fraudulent, they must remove it from your report.
| Action | Deadline | Reference |
|---|---|---|
| Credit card disputes | Send a dispute letter within 60 days of the statement date. | Consumer Financial Protection Bureau |
| Bank/debit errors (Reg E) | Notify bank within two business days to limit liability to $50. | See CFPB guidance and 12 CFR §1005.6 |
| Credit bureau investigations | Typically 30 days to investigate; they may request additional documentation within 15 days. | FCRA and related regulations |
| Fraud alert duration | Initial: 1 year; Extended: 7 years (with Identity Theft Report) | Place by contacting one bureau |
| Security freeze status | Remains until you lift it; free to lift temporarily | FTC: credit freeze overview |
Step 5: Consider Filing a Police Report
While the FTC Identity Theft Report is sufficient for most situations, you should consider filing a police report if:
A creditor or debt collector demands one before they'll clear fraudulent debts
You know who stole your identity (a family member, roommate, etc.)
The theft is extensive and involves multiple accounts or large amounts
You need documentation for insurance claims
File the report with your local police department or the department where the theft occurred. Bring your FTC Identity Theft Report, a government-issued ID, proof of address, and any evidence of the theft (fraudulent bills, account statements, etc.). Get a copy of the police report - some creditors may request it.
Step 6: Monitor Your Credit and Set Up Alerts
Identity theft recovery is not a one-time event. You need to stay vigilant for at least a year, and ideally longer. Set up these ongoing protections:
Regular credit monitoring: Check your credit reports from all three bureaus every few months. Look for new unauthorized accounts or inquiries. You can get free weekly reports at annualcreditreport.com.
Account alerts: Set up text or email alerts with your bank and credit card companies for any transaction over a certain amount, or for all transactions if possible.
Consider identity monitoring services: These services track your personal information and alert you to potential fraud. Be cautious of "free" offers with hidden fees. Many banks and credit cards offer free monitoring as a benefit.
If you placed a one-year fraud alert, set a calendar reminder to renew it before it expires. If you placed a security freeze, it stays in effect until you lift it.
Special Situations: When Identity Theft Gets Complicated
| Type | What to Look For | Who to Contact | Key Form/Action |
|---|---|---|---|
| Tax Identity Theft | IRS rejects your e-file or unexpected refund issues | IRS; report at IdentityTheft.gov | File Form 14039; get an Identity Protection PIN (IP PIN) for future tax seasons |
| Unemployment Fraud | State claim notice or a 1099-G you do not recognize | State workforce agency; report at IdentityTheft.gov | Notify employer HR; file taxes with accurate income only |
| Medical Identity Theft | Unknown services on EOB; errors in medical records | Health insurer; report to HHS Office of Inspector General fraud hotline at 1-800-447-8477 | Request records and corrections in writing |
| Child Identity Theft | Bills/collections in a child's name; blocked new account | Equifax, Experian, TransUnion for manual review | Provide proof of age/relationship; consider a credit freeze |
| Military & Veterans | Benefits-related anomalies or pay issues | VA OIG; DFAS fraud hotlines | Place an active duty alert (1 year; renewable) |
Tax-Related Identity Theft
Tax identity theft happens when someone uses your stolen Social Security number to file a fraudulent tax return and claim your refund. You'll typically discover this when the IRS rejects your legitimate return because one was already filed using your SSN.
If this happens to you:
File Form 14039, the IRS Identity Theft Affidavit, immediately. You can download it from IRS.gov or request it by calling 1-800-908-4490.
Continue to file your tax return on time, even if you have to file by paper because e-filing was rejected. Attach Form 14039 to your paper return.
The IRS will investigate, which can take several months. They'll send you a letter with instructions and may request additional documentation.
Consider getting an Identity Protection PIN (IP PIN) for future tax seasons. This six-digit code is known only to you and the IRS, and you must enter it on your tax returns. It's free and prevents thieves from filing in your name.
All taxpayers with an SSN or ITIN can voluntarily get an IP PIN, even if they haven't been victims of tax identity theft. The fastest way is through the "Get my IP PIN" tool on IRS.gov.
Unemployment Benefits Fraud
If someone files for unemployment benefits using your identity, you might receive a notice from your state workforce agency about a claim you didn't file, or a 1099-G tax form for unemployment income you never received.
Take these steps immediately:
Contact your state workforce agency's fraud department. Each state has its own reporting process. Find yours through your state's unemployment website.
Report the fraud at IdentityTheft.gov and create your recovery plan.
Notify your employer's human resources department so they're aware if the state contacts them.
When you file your taxes, report only the unemployment income you actually received. Attach a statement explaining the identity theft if necessary.
Medical Identity Theft
Medical identity theft occurs when someone uses your name or health insurance information to get medical services, prescriptions, or equipment. This is particularly dangerous because it can result in incorrect information being added to your medical records, potentially affecting your future care.
If you suspect medical identity theft:
Contact your health insurance company immediately and review your Explanation of Benefits (EOB) statements for services you didn't receive.
Request copies of your medical records from providers where fraudulent services occurred. Check them for inaccuracies and request corrections in writing.
Report the theft to the HHS Office of Inspector General fraud hotline at 1-800-447-8477 or online at oig.hhs.gov/fraud/hotline.
File a complaint with your state's attorney general or insurance commissioner.
Report at IdentityTheft.gov for your recovery plan.
Child Identity Theft
Children's Social Security numbers are valuable to identity thieves because the fraud can go undetected for years, until the child applies for student loans or their first job. You might discover it when you receive bills or collection notices in your child's name, or when you try to open a savings account for them and discover accounts already exist.
To protect and recover:
Contact the three credit bureaus and ask if your child has a credit report. Children shouldn't have credit reports unless they're victims of identity theft.
If a report exists, request a manual review and file disputes for all fraudulent accounts. You'll need to provide proof of your child's age (birth certificate) and your relationship to them.
Consider placing a security freeze on your child's credit file to prevent future fraud.
Report the theft at IdentityTheft.gov and follow the recovery plan for minors.
Military and Veterans
Active-duty military personnel and veterans can place an active duty alert on their credit reports, which lasts for one year (renewable). This is similar to a fraud alert but specifically designed for service members who may be deployed and unable to monitor their credit regularly.
Military members should also be aware of benefits-related identity theft, where someone fraudulently claims VA benefits or military pay. Report this to the VA Office of Inspector General or the Defense Finance and Accounting Service (DFAS) fraud hotline.
Key Terms You Should Know
Identity Theft Report: An official document created at IdentityTheft.gov that serves as proof you're a victim of identity theft. It combines your FTC complaint with optional police report details and gives you legal rights when dealing with creditors and credit bureaus.
Fraud Alert: A notice placed on your credit file that tells businesses to take extra steps to verify your identity before opening new accounts. An initial alert lasts one year; an extended alert (requiring an Identity Theft Report) lasts seven years. You only need to contact one credit bureau to place an alert.
Security Freeze (Credit Freeze): A restriction on your credit file that blocks most access, preventing identity thieves from opening new accounts in your name. You must contact each credit bureau separately to place or lift a freeze. It's free and doesn't affect your credit score or existing accounts.
Credit Bureau (Credit Reporting Agency): A company that collects information about your credit history and creates credit reports. The three major bureaus are Equifax, Experian, and TransUnion. You'll need to work with all three when recovering from identity theft.
Furnisher: A company that provides information to credit bureaus about your accounts - banks, credit card companies, lenders, etc. When you dispute fraudulent accounts, you'll contact both the credit bureaus and the furnishers.
Fair Credit Reporting Act (FCRA): Federal law that gives you rights regarding your credit reports, including the right to dispute inaccurate information and block fraudulent information resulting from identity theft.
IP PIN (Identity Protection PIN): A six-digit code issued by the IRS that you must enter when filing your federal tax return. It prevents anyone else from filing a return using your Social Security number.
Why This Matters: The Real Impact of Identity Theft
Identity theft can ripple through your finances, records, and peace of mind. Quick action limits damage; sustained follow-through restores your name.
Financial Damage Can Escalate Quickly
A thief with your information can drain bank accounts, max out credit cards, and open new lines of credit in your name within days. The average identity theft victim spends dozens of hours and potentially thousands of dollars resolving the fraud. Fraudulent accounts can damage your credit score, making it harder to get approved for loans, rent an apartment, or even get certain jobs that check credit.
But here is the good news: federal law provides strong protections. Your liability for unauthorized credit card charges is typically limited to $50, and most issuers waive even that. For bank accounts, quick reporting limits your liability. The key is acting fast. The longer fraud goes undetected, the more damage it causes.
Non-Financial Consequences Are Often Worse
Beyond money, identity theft can affect your life in ways that are harder to measure. Medical identity theft can corrupt your health records with someone else's information, potentially affecting your diagnosis or treatment. Criminal identity theft - when someone uses your name during an arrest - can result in warrants being issued in your name.
Tax identity theft can delay your legitimate refund for months while the IRS investigates. Unemployment fraud can affect your future ability to claim benefits when you actually need them. These situations require more than just disputing charges: they require clearing your name with government agencies, which takes time and persistence.
The Emotional Toll Is Real
Many identity theft victims report feeling violated, anxious, and overwhelmed. It's a normal response to discovering someone has stolen your identity and potentially damaged your reputation. The recovery process can be frustrating, with hours spent on hold, navigating bureaucracy, and proving you are who you say you are.
That's why the federal government created IdentityTheft.gov: to give you a clear roadmap and reduce the overwhelm. You don't have to figure this out alone. The resources exist, they're free, and thousands of people successfully recover every year.
Prevention Is Easier Than Recovery
Once you've recovered from identity theft, you'll understand why prevention matters. Simple habits can dramatically reduce your risk: using strong, unique passwords for every account; enabling two-factor authentication; being cautious about what personal information you share online; shredding documents with sensitive information; and monitoring your credit regularly.
Consider proactive measures like security freezes (even if you haven't been a victim), IRS IP PINs, and setting up account alerts. These take a few hours to implement but can save you weeks or months of recovery work.
Common Questions About Identity Theft Recovery
How long does identity theft recovery take?
Recovery time varies widely depending on the severity of the theft. Simple cases (one fraudulent credit card) might be resolved in a few weeks. Complex cases involving multiple accounts, tax fraud, or criminal identity theft can take six months to a year or longer. The key is starting immediately and following through on every step. Most victims see significant progress within 30-60 days if they act quickly.
Will identity theft hurt my credit score?
Fraudulent accounts and missed payments from identity theft can temporarily damage your credit score. However, once you dispute the fraudulent information and credit bureaus verify it's fraud, they must remove it from your report. This removal should restore your score. The process takes time, but your score should eventually return to where it was before the theft. Placing a fraud alert or security freeze does not affect your credit score.
Do I need to pay for credit monitoring or identity theft protection services?
Not necessarily. The federal government provides free tools (IdentityTheft.gov, free credit reports, free fraud alerts and security freezes) that give you most of what paid services offer. Many banks and credit card companies also offer free monitoring to their customers. If you do consider a paid service, read the terms carefully - some "free" offers have hidden fees or auto-renew at high prices.
Can I be held responsible for debts created by identity theft?
No, you are not legally responsible for debts resulting from identity theft if you report them properly. Your FTC Identity Theft Report and supporting documentation prove the accounts are fraudulent. Creditors and debt collectors cannot legally pursue you for these debts once you've provided proof of identity theft. If they continue collection efforts after you've reported the fraud, document everything and consider filing a complaint with the Consumer Financial Protection Bureau.
What if the identity thief is someone I know?
Identity theft by family members or acquaintances is more common than many people realize. The recovery process is the same, but you may face additional emotional challenges. You'll still need to report the theft at IdentityTheft.gov, dispute fraudulent accounts, and potentially file a police report. Law enforcement may ask if you know who committed the theft. You'll need to decide whether to cooperate with prosecution: a difficult decision when it involves someone close to you. Consider seeking support from a counselor or trusted advisor.
Should I close all my accounts and start over?
Not necessarily. Only close accounts that were actually compromised or opened fraudulently. Closing old, legitimate accounts can actually hurt your credit score by reducing your credit history length. Instead, secure your existing legitimate accounts by changing passwords, setting up alerts, and monitoring them closely. Close and replace only the specific accounts affected by fraud.
How do I know if I've found all the fraudulent accounts?
Check all three credit reports thoroughly - sometimes fraudulent accounts appear on only one or two bureaus. Review several months of bank and credit card statements for any unauthorized charges. Monitor your mail for bills or statements from companies you don't recognize. Set up informed delivery with USPS to track what mail is coming. Continue checking your credit reports every few months for the next year. New fraudulent accounts sometimes appear months after the initial theft.
What if a creditor doesn't believe I'm a victim of identity theft?
This is why your FTC Identity Theft Report is so important. Under federal law, businesses must accept it as proof of identity theft. If a creditor refuses to remove fraudulent charges or close fake accounts after you've provided your Identity Theft Report, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or 1-855-411-2372. You can also contact your state attorney general's office. Document all your communications with the creditor.
Can identity theft affect my immigration status or security clearance?
Identity theft itself shouldn't affect your immigration status or security clearance, but you should report it promptly to prevent complications. For immigration matters, notify USCIS if someone has used your identity for immigration fraud. For security clearances, report the theft to your security officer - failing to report it could be more problematic than the theft itself. Document everything about your recovery efforts to show you handled the situation responsibly.
Your Action Plan: What to Do Right Now
Action Plan Timeline
Today (Next 2 Hours)
Go to IdentityTheft.gov and start your report. Save your recovery plan.
Call your bank and credit card companies to report fraud and freeze affected accounts.
Place a fraud alert by calling one credit bureau (they'll notify the others).
Change passwords on your email, bank, and other important online accounts.
This Week
Get your free credit reports from all three bureaus at annualcreditreport.com.
Review reports carefully and document every fraudulent account or inquiry.
Decide whether to place security freezes for maximum protection.
Send dispute letters to credit bureaus and creditors about fraudulent accounts.
File a police report if needed for your situation.
This Month
Follow up on all disputes if you haven't received responses within 30 days.
Check that fraudulent accounts have been closed and removed from credit reports.
Set up account alerts and monitoring for ongoing protection.
If applicable, file IRS Form 14039 or report other specialized fraud types.
Next 6-12 Months
Check your credit reports every few months for new fraudulent activity.
Monitor your mail and email for collection notices or bills from unknown companies.
Renew your fraud alert before it expires if you haven't placed a freeze.
Consider getting an IRS IP PIN before next tax season.
Review and strengthen your overall identity protection habits.
Important Disclaimers
This guide provides general information about identity theft recovery based on federal resources and consumer protection laws. It is not legal advice, and your specific situation may require consultation with an attorney, especially for complex cases involving criminal identity theft or significant financial damage.
Laws and procedures vary by state. While federal protections apply nationwide, your state may have additional rights or requirements. Check with your state attorney general's office for state-specific guidance.
The contact information and websites listed were accurate as of publication, but agencies occasionally update their contact methods. If a number or website doesn't work, visit the agency's main website for current contact information.
Identity theft recovery can be stressful and time-consuming. If you feel overwhelmed, consider asking a trusted family member or friend to help you work through the steps, or contact a nonprofit credit counseling agency for guidance. The important thing is to start the process: every step you take reduces the damage and moves you closer to resolution.